Analysis
-
max time kernel
145s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:42
Static task
static1
General
-
Target
b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe
-
Size
790KB
-
MD5
2929cb865057a0b17ddd59a1cb059f91
-
SHA1
084423f5e8967e45ebec4b50ac97e3c9d304efff
-
SHA256
b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef
-
SHA512
a637dc465498fa572638203ca821f26808ede97f007350974a05e3b53302c560877a80db341108636d0bbeac2dc312c18b6f0de39283e5bf50aa5ad0860de926
-
SSDEEP
24576:/yapryNy4FhexftAB5eZXnnbjHH/0PY2:KYtmhexVQWnfeY
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it565918.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it565918.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it565918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it565918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it565918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it565918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it565918.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/4348-161-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-162-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-164-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-166-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-171-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-174-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-176-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-178-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-180-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-182-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-184-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-186-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-188-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-190-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-192-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-194-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-196-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-198-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-200-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-202-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-204-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-206-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-208-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-210-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-212-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-214-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-216-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-218-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-220-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-222-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-224-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-226-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-228-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/4348-1081-0x0000000004B60000-0x0000000004B70000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr255213.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr255213.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
zifR7120.exeziNB1865.exeit565918.exejr230476.exekp298838.exelr255213.exeoneetx.exeoneetx.exepid process 1340 zifR7120.exe 848 ziNB1865.exe 1300 it565918.exe 4348 jr230476.exe 4960 kp298838.exe 1728 lr255213.exe 2784 oneetx.exe 2688 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3912 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it565918.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it565918.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exezifR7120.exeziNB1865.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zifR7120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zifR7120.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziNB1865.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziNB1865.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 744 4348 WerFault.exe jr230476.exe 4648 1728 WerFault.exe lr255213.exe 3380 1728 WerFault.exe lr255213.exe 724 1728 WerFault.exe lr255213.exe 1864 1728 WerFault.exe lr255213.exe 948 1728 WerFault.exe lr255213.exe 1460 1728 WerFault.exe lr255213.exe 1700 1728 WerFault.exe lr255213.exe 4820 1728 WerFault.exe lr255213.exe 4624 1728 WerFault.exe lr255213.exe 4104 1728 WerFault.exe lr255213.exe 408 2784 WerFault.exe oneetx.exe 4148 2784 WerFault.exe oneetx.exe 1180 2784 WerFault.exe oneetx.exe 1480 2784 WerFault.exe oneetx.exe 3404 2784 WerFault.exe oneetx.exe 4320 2784 WerFault.exe oneetx.exe 2856 2784 WerFault.exe oneetx.exe 4548 2784 WerFault.exe oneetx.exe 3284 2784 WerFault.exe oneetx.exe 1752 2784 WerFault.exe oneetx.exe 3340 2784 WerFault.exe oneetx.exe 1820 2784 WerFault.exe oneetx.exe 4012 2688 WerFault.exe oneetx.exe 4744 2784 WerFault.exe oneetx.exe 1020 2784 WerFault.exe oneetx.exe 4216 2784 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it565918.exejr230476.exekp298838.exepid process 1300 it565918.exe 1300 it565918.exe 4348 jr230476.exe 4348 jr230476.exe 4960 kp298838.exe 4960 kp298838.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it565918.exejr230476.exekp298838.exedescription pid process Token: SeDebugPrivilege 1300 it565918.exe Token: SeDebugPrivilege 4348 jr230476.exe Token: SeDebugPrivilege 4960 kp298838.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr255213.exepid process 1728 lr255213.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exezifR7120.exeziNB1865.exelr255213.exeoneetx.exedescription pid process target process PID 3492 wrote to memory of 1340 3492 b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe zifR7120.exe PID 3492 wrote to memory of 1340 3492 b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe zifR7120.exe PID 3492 wrote to memory of 1340 3492 b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe zifR7120.exe PID 1340 wrote to memory of 848 1340 zifR7120.exe ziNB1865.exe PID 1340 wrote to memory of 848 1340 zifR7120.exe ziNB1865.exe PID 1340 wrote to memory of 848 1340 zifR7120.exe ziNB1865.exe PID 848 wrote to memory of 1300 848 ziNB1865.exe it565918.exe PID 848 wrote to memory of 1300 848 ziNB1865.exe it565918.exe PID 848 wrote to memory of 4348 848 ziNB1865.exe jr230476.exe PID 848 wrote to memory of 4348 848 ziNB1865.exe jr230476.exe PID 848 wrote to memory of 4348 848 ziNB1865.exe jr230476.exe PID 1340 wrote to memory of 4960 1340 zifR7120.exe kp298838.exe PID 1340 wrote to memory of 4960 1340 zifR7120.exe kp298838.exe PID 1340 wrote to memory of 4960 1340 zifR7120.exe kp298838.exe PID 3492 wrote to memory of 1728 3492 b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe lr255213.exe PID 3492 wrote to memory of 1728 3492 b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe lr255213.exe PID 3492 wrote to memory of 1728 3492 b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe lr255213.exe PID 1728 wrote to memory of 2784 1728 lr255213.exe oneetx.exe PID 1728 wrote to memory of 2784 1728 lr255213.exe oneetx.exe PID 1728 wrote to memory of 2784 1728 lr255213.exe oneetx.exe PID 2784 wrote to memory of 644 2784 oneetx.exe schtasks.exe PID 2784 wrote to memory of 644 2784 oneetx.exe schtasks.exe PID 2784 wrote to memory of 644 2784 oneetx.exe schtasks.exe PID 2784 wrote to memory of 3912 2784 oneetx.exe rundll32.exe PID 2784 wrote to memory of 3912 2784 oneetx.exe rundll32.exe PID 2784 wrote to memory of 3912 2784 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe"C:\Users\Admin\AppData\Local\Temp\b39e12122cb239318d5540eda989fd0095744f9faabf6fbb3ab385412af4d5ef.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifR7120.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifR7120.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziNB1865.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziNB1865.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it565918.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it565918.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230476.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230476.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 14645⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp298838.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp298838.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255213.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255213.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 7843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 8723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 12243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 12683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 13243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 8884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 10124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 10804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 11044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 11244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 11204⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 7684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 12804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 12844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 11644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 15404⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 11484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 13723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4348 -ip 43481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1728 -ip 17281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2784 -ip 27841⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2784 -ip 27841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2784 -ip 27841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255213.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255213.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifR7120.exeFilesize
524KB
MD5b20114aa81dabc261cda9058ded2555a
SHA11b238f45564926473140cda682d1c2bd84edfab2
SHA2561a62dcc228a3ea52b0acf2cc9e2a33c8d82394d8bc30896600de4906b2523708
SHA512f433f5886e57976f68321c7f28de4b9d5c938c2c3b2f7d9dbd610a006fd8973753d102a36658c5e9a9c616e3048f60f778ee428bd0bd0f6ba4c9ca42d8d5331e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifR7120.exeFilesize
524KB
MD5b20114aa81dabc261cda9058ded2555a
SHA11b238f45564926473140cda682d1c2bd84edfab2
SHA2561a62dcc228a3ea52b0acf2cc9e2a33c8d82394d8bc30896600de4906b2523708
SHA512f433f5886e57976f68321c7f28de4b9d5c938c2c3b2f7d9dbd610a006fd8973753d102a36658c5e9a9c616e3048f60f778ee428bd0bd0f6ba4c9ca42d8d5331e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp298838.exeFilesize
176KB
MD5369017c82d4db87007a1c6aff99f30c2
SHA15ff00053413f318470850f46ba2f06639dca47e7
SHA256f52a402094f9209b7c51774d017ed967e1c81d8ac205fdd9f256c65d9c6ee3a4
SHA5122573ace41e2c46c7d1f4d08d2d7fe541676bb535087bb6173216621c523069e8c96f42732ec66edfe5f8755256c604ff300d2668a686735e56106bbd5d105334
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp298838.exeFilesize
176KB
MD5369017c82d4db87007a1c6aff99f30c2
SHA15ff00053413f318470850f46ba2f06639dca47e7
SHA256f52a402094f9209b7c51774d017ed967e1c81d8ac205fdd9f256c65d9c6ee3a4
SHA5122573ace41e2c46c7d1f4d08d2d7fe541676bb535087bb6173216621c523069e8c96f42732ec66edfe5f8755256c604ff300d2668a686735e56106bbd5d105334
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziNB1865.exeFilesize
382KB
MD5635b14e3d110e6f5292851b6ba4c2608
SHA1a1ad0cf37354a2dc11890edb1b900c0b49cc276a
SHA256b704c7c629b7ed3c826fbd59c84ba1e6e5703c1917187ca36539fffc002159e9
SHA51289087bafc431bd2e49012d17e54df216668e182b5ad680de5dd770025f86eb6408df73bb600f07fcfb13085831a0d1fe0acc126f995f39dcf906f97949472afa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziNB1865.exeFilesize
382KB
MD5635b14e3d110e6f5292851b6ba4c2608
SHA1a1ad0cf37354a2dc11890edb1b900c0b49cc276a
SHA256b704c7c629b7ed3c826fbd59c84ba1e6e5703c1917187ca36539fffc002159e9
SHA51289087bafc431bd2e49012d17e54df216668e182b5ad680de5dd770025f86eb6408df73bb600f07fcfb13085831a0d1fe0acc126f995f39dcf906f97949472afa
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it565918.exeFilesize
11KB
MD590a993811e83e57d65c744b9e24c5d58
SHA1ceb017e5d9f0773ca64befdeb486383de1045adb
SHA256e91504eef3b938cb0df32a0202a4d3b5a1b74eaa73af05432594920b20e71399
SHA512af7a083a632343ddb6ecf6691466222f6e420b9157c27cdfcc02e51358a351e33731f788fa05e86a01e196386a2084077415af08a608bb8dd665797fd85a3793
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it565918.exeFilesize
11KB
MD590a993811e83e57d65c744b9e24c5d58
SHA1ceb017e5d9f0773ca64befdeb486383de1045adb
SHA256e91504eef3b938cb0df32a0202a4d3b5a1b74eaa73af05432594920b20e71399
SHA512af7a083a632343ddb6ecf6691466222f6e420b9157c27cdfcc02e51358a351e33731f788fa05e86a01e196386a2084077415af08a608bb8dd665797fd85a3793
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230476.exeFilesize
297KB
MD52b7cded83ca613b1b2528a73d07c7c86
SHA1e530b68bf3f505cfd22302441a3179508cc28dd9
SHA256bfe3467cf5f4fe68bfe05acb1ec2d635bf6e852ce9ee4938d7944da5259a2d40
SHA5122e2b3068433867f7ec5e3c1c3b8f94d68d098eba3da23dcb2a5b0419df2979697db015d666ccfab279effed9fe54e1a3690664f358bf931305d31954a49e6701
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230476.exeFilesize
297KB
MD52b7cded83ca613b1b2528a73d07c7c86
SHA1e530b68bf3f505cfd22302441a3179508cc28dd9
SHA256bfe3467cf5f4fe68bfe05acb1ec2d635bf6e852ce9ee4938d7944da5259a2d40
SHA5122e2b3068433867f7ec5e3c1c3b8f94d68d098eba3da23dcb2a5b0419df2979697db015d666ccfab279effed9fe54e1a3690664f358bf931305d31954a49e6701
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1300-154-0x0000000000A80000-0x0000000000A8A000-memory.dmpFilesize
40KB
-
memory/1728-1099-0x00000000006D0000-0x000000000070B000-memory.dmpFilesize
236KB
-
memory/4348-204-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-226-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-178-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-180-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-172-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-182-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-184-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-186-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-188-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-190-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-192-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-194-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-196-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-198-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-200-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-202-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-174-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-206-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-208-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-210-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-212-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-214-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-216-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-218-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-220-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-222-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-224-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-176-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-228-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-1071-0x0000000005120000-0x0000000005738000-memory.dmpFilesize
6.1MB
-
memory/4348-1072-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/4348-1073-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4348-1074-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4348-1075-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-1077-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4348-1078-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4348-1079-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-1080-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-1081-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-1082-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/4348-1083-0x0000000006650000-0x0000000006B7C000-memory.dmpFilesize
5.2MB
-
memory/4348-1084-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-1085-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/4348-1086-0x0000000006E90000-0x0000000006EE0000-memory.dmpFilesize
320KB
-
memory/4348-170-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-171-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-167-0x00000000005A0000-0x00000000005EB000-memory.dmpFilesize
300KB
-
memory/4348-168-0x0000000004B60000-0x0000000004B70000-memory.dmpFilesize
64KB
-
memory/4348-166-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-164-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-162-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-161-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/4348-160-0x0000000004B70000-0x0000000005114000-memory.dmpFilesize
5.6MB
-
memory/4960-1092-0x0000000000ED0000-0x0000000000F02000-memory.dmpFilesize
200KB
-
memory/4960-1093-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB